CCDV-F Practice Test 4 — 25 Questions

Question 1

A developer is building a customer-support assistant that must answer only from a provided knowledge base article and must refuse to answer when the article does not contain the information. The assistant currently invents plausible answers. Which prompt change best enforces the refusal behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Instruct the model to answer only using information found in the article and to respond with a fixed phrase such as 'I don't have that information' when the article is insufficient.. Grounding requires two explicit constraints: define the permitted source and define what to do when that source is inadequate. Naming the article as the only allowed source, plus a fixed refusal phrase for missing information, gives the model an unambiguous rule and produces a consistent, detectable abstention. Tone, token limits, and document placement do not establish either constraint.

Answer

Increase the max_tokens parameter so the model has more room to explain its reasoning.

Answer

Move the knowledge base article to the end of the prompt so it is the last thing the model reads.

Answer

Add an instruction to answer in a polite and professional tone at all times.

Question 2

A developer is writing an MCP client that must stay responsive while a server performs a slow operation during a tool call. The client should allow the user to cancel the request without terminating the whole session, and the server should be able to stream incremental output before finishing. Which two MCP features should the developer implement? (Choose two.)

Accepted Answer

Request cancellation using the notifications/cancelled notification with the in-flight request ID.. Long-running MCP operations are handled with progress notifications tied to a client-supplied progress token and with out-of-band cancellation via notifications/cancelled. Together they let a server report partial progress and let a client abort one request without disturbing the session, which is precisely the behavior the scenario demands.

Answer

Polling tools/list repeatedly to detect when the tool has finished executing.

Answer

Closing the transport and reinitializing the session to interrupt the operation.

Answer

Setting a long client-side timeout and retrying the same request until it succeeds.

Question 3

A developer is using the Anthropic API to build a customer support chatbot. The chatbot must access a backend CRM to retrieve customer details. The security team requires that the chatbot only accesses records for the authenticated customer and that the CRM credentials are never exposed to the model. Which approach best satisfies these requirements?

Accepted Answer

Implement a backend service that authenticates the user, retrieves the customer ID, and calls the CRM with its own credentials, then returns only the necessary data to Claude.. The best approach is a backend service that authenticates the user, retrieves the customer ID, and calls the CRM with its own credentials, returning only necessary data to Claude. This keeps credentials server-side and enforces that the chatbot only accesses records for the authenticated customer.

Answer

Pass the CRM API key to Claude in the system prompt so it can include the key when calling the CRM tool.

Answer

Store the CRM credentials in the model's fine-tuning data so it can learn to call the CRM securely.

Answer

Have Claude generate CRM API calls and execute them directly from the client-side application using the customer's browser session.

Question 4

A developer is building a real-time chat application where users expect responses in under two seconds. The prompts are short (under 200 tokens) and the responses are typically one or two sentences. Which Claude model should the developer choose to optimize for latency and cost?

Accepted Answer

Claude 3 Haiku. For a real-time chat application with short prompts and simple responses, latency and cost are critical. Claude 3 Haiku is specifically designed to be the fastest and most affordable model in the Claude 3 family, making it ideal for this use case. More powerful models like Opus or Sonnet would add unnecessary cost and latency without providing meaningful benefits for such straightforward interactions.

Answer

Claude 3.5 Sonnet

Answer

Claude 3 Opus

Answer

Claude 2.1

Question 5

A developer's MCP client sends a tools/call request for a tool that performs a database write. The tool result comes back with is_error set to true and a message about a unique-constraint violation. What is the most appropriate way for the client to handle this result?

Accepted Answer

Surface the error content to Claude as the tool result so it can reason about the failure and adjust its next action.. Tool errors are delivered in-band as a tool result with is_error set to true, and the accompanying content is meant to inform the next reasoning step. Returning that result to Claude preserves the conversation loop and lets the model adapt, which is the correct handling for a recoverable data-level failure such as a constraint violation.

Answer

Convert the tool result into a plain assistant text message and end the turn without invoking Claude again.

Answer

Terminate the MCP session and reconnect before retrying the tool call.

Answer

Discard the result and silently retry the identical tool call up to three times.

Question 6

A developer is designing a prompt that asks Claude to extract action items from meeting transcripts. The transcripts are noisy, with overlapping speakers and side conversations. Which TWO prompt-engineering practices will most improve the reliability of the extracted action items? (Choose two.)

Accepted Answer

Instruct the model to think step by step internally before emitting the final list, then output only the list.. Few-shot examples anchor the noisy-input-to-clean-output mapping, and asking for internal reasoning before the final list lets the model resolve attribution and filter side talk. Together they address the two hard parts of this task: deciding what counts as an action item and deciding who owns it. Output limits and label removal do not improve either decision.

Answer

Remove all speaker labels to reduce token count before sending the transcript.

Answer

Set the max_tokens parameter as high as possible so the model never truncates an action item.

Answer

Ask the model to include every sentence that mentions a task, regardless of who said it.

Question 7

A developer notices that a Claude integration's monthly bill is far higher than expected. Logs show that each request includes a 15,000-token system prompt containing detailed style guidelines, plus a 200-token user question, and the model generates a 50-token answer. The system prompt is identical across all requests. Which change would MOST reduce cost without altering output quality?

Accepted Answer

Enable Prompt Caching on the static system prompt so repeated requests pay a reduced cache-read rate for those tokens.. The dominant cost driver is the 15,000-token system prompt repeated on every request. Since it is static, Prompt Caching reduces the billed rate for those tokens on subsequent calls while keeping the prompt intact. This preserves output quality exactly and targets the largest cost component, making it the most effective change.

Answer

Shorten the system prompt by removing style guidelines that the model already follows by default.

Answer

Move the user question before the system prompt so the model processes it first.

Answer

Switch to a model with a smaller context window to force the system prompt to be truncated automatically.

Question 8

An enterprise uses Claude to generate SQL queries from natural-language questions against a production database. The security team wants to prevent the model from producing destructive statements such as DROP TABLE. Which control provides the strongest guarantee?

Accepted Answer

Execute generated SQL with a database role that has only SELECT privileges on the required views.. The strongest guarantee comes from enforcing least privilege in the database, because the database engine will reject destructive statements regardless of what the model generates. Prompt instructions and keyword filters operate before execution and can be bypassed or produce errors. Logging is only detective. By executing generated SQL with a read-only role scoped to required views, the system prevents destructive operations by design.

Answer

Add a system prompt that instructs Claude to only generate SELECT statements.

Answer

Parse the generated SQL and reject any statement containing the word DROP or DELETE.

Answer

Log all generated SQL statements and alert the security team when destructive keywords appear.

Question 9

A developer is creating a multi-agent system where a coordinator agent delegates subtasks to specialized agents. Each specialized agent has its own tools and system prompt. The coordinator needs to know when a subtask is complete and what result was produced. Which design best fits the Anthropic SDK's stateless model?

Accepted Answer

Have the coordinator invoke each specialized agent as a tool, passing the subtask as input and receiving the agent's final result as the tool output.. Because each API call is independent, delegation is best modeled as a tool call: the coordinator requests a sub-agent by name, the application runs it and returns the result as tool output. This creates an explicit contract for completion and results, and it keeps each specialized agent's tools and system prompt isolated.

Answer

Have the coordinator and specialized agents share a single conversation history that all agents append to directly.

Answer

Have all specialized agents run in parallel and write their outputs to a shared memory store that the model reads automatically.

Answer

Have the coordinator emit a plain text message describing the subtask and rely on the specialized agent to detect it by polling.

Question 10

A developer is building an internal Claude-powered assistant using the Anthropic API. The assistant must access a proprietary knowledge base stored in an Amazon S3 bucket. The security team requires that the assistant never receives long-lived AWS credentials and that access is tightly scoped to only the necessary S3 prefix. Which approach best meets these requirements?

Accepted Answer

Configure the application to assume an IAM role with a scoped policy and retrieve temporary credentials via AWS STS, then use those credentials only within the tool's execution context.. The correct approach uses temporary credentials from AWS STS via an assumed IAM role. This ensures no long-lived keys exist, access is scoped to the required S3 prefix through the role's policy, and credentials are only present during tool execution. Static keys or public access fail the requirements and increase risk.

Answer

Embed the S3 bucket's public URL in the tool code and rely on the bucket being publicly readable for the specific prefix.

Answer

Store IAM user access keys in environment variables on the application server and pass them to the tool that reads S3.

Answer

Create a separate IAM user for the assistant and attach the AmazonS3FullAccess managed policy so it can read any bucket.

Question 11

A developer maintains a Claude-powered assistant that answers questions over a 60,000-token internal policy corpus. The corpus is stable and reused across every request, and the developer wants to cut cost and latency while preserving answer quality. Which two changes will most directly reduce per-request token processing for this workload? (Choose two.)

Accepted Answer

Retrieve only the policy sections relevant to each question and place those sections in the prompt instead of the full corpus.. Prompt caching avoids reprocessing the unchanged corpus prefix, and retrieval shrinks the context to only the passages a given question needs. Both act directly on the number of tokens the model must process per request, and both preserve quality because the relevant policy content remains available to the model.

Answer

Raise the temperature so Claude explores a wider range of possible answers and settles faster.

Answer

Add a system instruction telling Claude to read the corpus more quickly to save tokens.

Answer

Convert the corpus to a single long paragraph with no headings to reduce whitespace tokens.

Question 12

A developer is implementing an MCP client that connects to a remote MCP server over HTTP. The server requires authentication using an API key. The developer wants to ensure that all requests from the client include the API key in the headers. Which approach is correct for configuring the MCP client?

Accepted Answer

Set the API key in the 'Authorization' header when establishing the HTTP connection to the MCP server.. The correct approach is to set the API key in the 'Authorization' header of the HTTP connection. MCP over HTTP relies on standard HTTP authentication mechanisms, and headers are the appropriate place for credentials. Other methods either misuse query parameters, confuse client and server roles, or attempt to embed authentication in the JSON-RPC body, which is not standard.

Answer

Include the API key in the body of each MCP JSON-RPC request.

Answer

Pass the API key as an environment variable when starting the MCP server process.

Answer

Include the API key as a query parameter in the MCP server URL.

Question 13

A developer is adding a 'calculate_shipping' tool to an existing MCP server used by a Claude-based checkout assistant. The tool needs the destination country, package weight in kilograms, and an optional express flag. Which tool definition practice will MOST reliably let Claude call the tool correctly?

Accepted Answer

Define an input schema with typed properties for country, weight_kg, and express, mark the first two as required, and write a description that explains units and when to use the tool.. Tool definitions work best when the schema encodes structure and the description encodes intent. Typed properties for country, weight_kg, and express, with only the truly necessary fields required, give Claude an unambiguous contract. Documenting units and usage in the description helps the model choose the tool and format arguments correctly, which is the most reliable path to accurate invocations.

Answer

Omit the input schema entirely and rely on the tool name 'calculate_shipping' to imply the required arguments.

Answer

Set every property as required, including express, and instruct Claude to pass false when the user does not mention express shipping.

Answer

Accept a single free-form 'details' string and parse it inside the tool handler, since Claude writes natural language well.

Question 14

A developer is creating an agent that uses the Anthropic SDK to answer customer support questions. The agent has access to a tool that retrieves order status from an internal API. During testing, the developer notices that the agent sometimes provides an order status without calling the tool, resulting in incorrect information. What is the most likely cause of this behavior?

Accepted Answer

The tool's description is too vague, so the model does not understand when it should be used.. The most likely cause is a vague tool description. The model uses the description to understand the tool's purpose and when to invoke it. If the description does not clearly explain that the tool retrieves order status, the model may answer from its own knowledge, leading to incorrect information. Improving the description will guide the model to use the tool appropriately.

Answer

The agent's system prompt does not include the current date, so the model cannot determine order freshness.

Answer

The `tool_choice` parameter is set to `{"type": "auto"}`, which allows the model to ignore tools.

Answer

The model's temperature is set too high, causing it to hallucinate tool calls.

Question 15

A developer sends a Messages API request that includes a system prompt and several prior turns, and Claude replies with stop_reason set to "max_tokens" even though the conversation is short. They want Claude to finish its thought rather than truncate. Which change most directly addresses the truncation?

Accepted Answer

Increase the max_tokens value in the request so Claude has more room to complete its response.. The stop_reason value max_tokens is a direct signal that the output token limit was reached before the model finished. The remedy is to raise max_tokens within the model's context constraints; stop sequences, temperature, and prompt placement do not affect how many output tokens are permitted.

Answer

Move the instructions from the system prompt into the first user turn to free output tokens.

Answer

Lower the temperature to 0 so the response becomes deterministic and naturally shorter.

Answer

Add a stop_sequence that matches the end of the expected answer so Claude knows when to stop.

Question 16

A developer is building a customer-facing chatbot using the Claude API. The bot must respond within 1.5 seconds on average. The team initially selected claude-3-opus-20240229 for its high quality, but latency is consistently above 3 seconds. They need to reduce latency while maintaining acceptable response quality. Which action should the developer take?

Accepted Answer

Switch to claude-3-haiku-20240307 and evaluate response quality against the original model.. The chatbot's strict latency requirement makes model selection critical. Opus prioritizes quality over speed, while Haiku is optimized for fast responses. Switching to Haiku directly addresses the performance bottleneck. The other options either do not affect model inference speed or only change how output is delivered, not how quickly it is produced. The developer should then verify that Haiku's quality is sufficient for the use case.

Answer

Increase the max_tokens parameter to allow the model to generate more tokens per response.

Answer

Add a system prompt instructing Claude to respond as quickly as possible.

Answer

Enable streaming in the API request so that tokens are delivered incrementally.

Question 17

A developer wants Claude Code to understand the team's API conventions, directory layout, and preferred testing framework for a specific service, and wants that guidance loaded automatically at the start of every session in that repository without typing it. What is the most appropriate way to accomplish this?

Accepted Answer

Place a CLAUDE.md file in the repository root containing the conventions, layout notes, and testing framework guidance.. CLAUDE.md is the designated project memory file. Claude Code automatically reads it at the start of a session in the repository, so conventions, layout notes, and testing framework preferences placed there are available without manual effort. Manual pasting, unsupported settings fields, and scattered code comments cannot deliver the same consistent, automatic, repository-wide context loading that the developer needs.

Answer

Add the conventions as comments in a source file that Claude Code is likely to read during the session.

Answer

Create a `.claude/settings.json` entry with a `systemPrompt` field containing the conventions.

Answer

Paste the conventions into the first message of each session before asking for changes.

Question 18

A developer is preparing to deploy a Claude-powered internal assistant that can query a customer database through a tool. Before release, the security team asks for evidence that the assistant cannot be manipulated into returning another customer's records. Which practice provides the strongest proactive assurance?

Accepted Answer

Run a red-team exercise with adversarial prompts and tool-call attempts, and fix any issue where the assistant returns records outside the caller's authorized scope.. The strongest proactive assurance comes from actively attempting to break the authorization boundary and verifying that the system holds. Red-teaming with adversarial prompts and tool-call attempts tests the real behavior of the assistant and its tools, and fixing any discovered access-control failures before release produces evidence the security team can rely on. Prompt instructions, larger context, and after-the-fact monitoring do not enforce or prove the boundary.

Answer

Add a system prompt that says the assistant must only return records belonging to the authenticated user.

Answer

Monitor production logs after launch and alert when the assistant returns records that look unusual.

Answer

Increase the model's context window so it can hold all relevant customer records and reason about authorization more reliably.

Question 19

A developer stores the Anthropic API key in a mobile application's source code so the app can call Claude directly from the device. A security review flags this as a critical issue. Which remediation best addresses the root cause?

Accepted Answer

Move the Anthropic API calls to a backend service and have the mobile app authenticate to that service instead of holding the API key.. Secrets embedded in client binaries are recoverable by anyone who obtains the app, so the only durable fix is to remove the credential from the client. A backend proxy keeps the Anthropic API key server-side, lets you enforce user-level authentication and quotas, and allows key rotation without redistributing the application.

Answer

Restrict the API key to a single IP address range so only the corporate network can use it.

Answer

Obfuscate the API key using a commercial mobile app hardening tool before shipping the build.

Answer

Rotate the API key on a fixed schedule and embed the new key in each app release.

Question 20

A developer is building an internal Claude-powered assistant that calls the Anthropic API. The security policy states that API keys must never be embedded in client-side code or committed to source control. Which practice best satisfies this requirement?

Accepted Answer

Store the API key in a server-side secrets manager and have the backend proxy requests to the Anthropic API.. The secure pattern is to keep the Anthropic API key server-side in a managed secrets store and route all model calls through a backend proxy. That way the credential is never shipped to clients or stored in source control, and the backend can add authorization, rate limiting, and audit logging. Client-side encoding or committing to a private repo does not remove exposure.

Answer

Generate a new API key for each user session and embed it in the session cookie.

Answer

Obfuscate the API key with Base64 encoding before embedding it in the client bundle.

Answer

Commit the key to a private repository and rely on repository access controls.